Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-01 22:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Packets with TSO: address review feedback.

Browse source 
This addresses review feedback of GH-1831 and additionally fixes one
case in which PayloadLen was used in a way that would have given
problematic results when TSO is enabled.
This commit is contained in:
Johanna Amann 2021-11-09 15:11:27 +00:00
parent e14b695497
commit a011b4cb70
2 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/IP.cc
View file

@ -384,7 +384,13 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const
auto tcp_hdr = make_intrusive<RecordVal>(tcp_hdr_type);
int tcp_hdr_len = tp->th_off * 4;
int data_len = PayloadLen() - tcp_hdr_len;
// account for cases in which the payload length in the TCP header is not set,
// or is set to an impossible value. In these cases, return 0.
int data_len = 0;
auto payload_len = PayloadLen();
if ( payload_len >= tcp_hdr_len )
data_len = payload_len - tcp_hdr_len;
tcp_hdr->Assign(0, val_mgr->Port(ntohs(tp->th_sport), TRANSPORT_TCP));
tcp_hdr->Assign(1, val_mgr->Port(ntohs(tp->th_dport), TRANSPORT_TCP));

3
src/IP.h
View file

@ -411,6 +411,9 @@ public:
/**
* Returns the length of the IP packet's payload (length of packet minus
* header length or, for IPv6, also minus length of all extension headers).
*
* Also returns 0 if the IPv4 length field is set to zero - which is, e.g.,
* the case when TCP segment offloading is enabled.
*/
uint16_t PayloadLen() const
{